How to Manually Update the Malware Engine in Exchange 2013
I had an interesting case where a HTTP proxy server was preventing Exchange 2013 from updating the malware engine. The customer wanted to manually update the malware engine until his network security team could get the needed exceptions in their proxy server. I found several posts that cover this including:
Exchange 2013 Malware Engine Updates Troubleshooting
Download engine and definition updates
All had good information, but I found the procedures to be a little less than clear and ended up pulling parts of procedures out of them and putting them together. I also found some of the procedures overly complicated. Since I had to put instructions together for a customer anyway, I thought I would post them here.
1. Go to any computer that you know you can get to the update site at https://forefrontdl.microsoft.com/server/scanengineupdate. Attempting to connect to this site in a browser should render a 403 forbidden, that's ok, it confirms the path is accessible and that's all we need.
2. Grab the update script from https://support.microsoft.com/kb/2292741and save it to a local folder. For my purposes, I used c:\script.
3. Open File Explorer and create the following folder: c:\ScanEngineUpdates
4. Open Windows Powershell, cd to the folder you saved the script to. In my case c:\script , and Run :
.\Update-Engines.ps1 -EngineDirPath C:\ScanEngineUpdates\ -UpdatePathUrl https://forefrontdl.microsoft.com/server/scanengineupdate/ -Engines Microsoft -Platforms amd64, x86
If you have any trouble executing the script due to restrictions, you can run: set-executionpolicy -unrestricted to allow it. Be sure to set it back to default when you are done: set-executionpolicy -default .
This will download the files with the right folder structure needed to C:\ScanEngineUpdates\
5. Copy the folder structure and files you just created to a server that you can create a share on that is accessible to your Exchange 2013 server. I did a right click and copied the c:\ScanEngineUpdates folder then pasted to c:\ on my file server. Create a share to this folder. For my purposes, I named the share "ScanEngineUpdates".
6. Now you need to make a decision, is this a permanent arrangement where you will manually download the updates or is it temporary? If it is permanent, you need to run the following command in the Exchange Management Shell for all your mailbox servers to set the primary URL for engine updates:
Set-MalwareFilteringServer <serverName> –PrimaryUpdatePath \\<Server>\<ResourceName>
For my purposes, I ran Set-MalwareFilteringServer wingtip-e2k13 –PrimaryUpdatePath \\WINGTIP-E2K13\ScanEngineUpdates.
If this is temporary, we don't want to change the primary. Instead we want to change the secondary. Run this:
Set-MalwareFilteringServer <serverName> –SecondaryUpdatePath \\<Server>\<ResourceName>
I ran: Set-MalwareFilteringServer wingtip-e2k13 –SecondaryUpdatePath \\WINGTIP-E2K13\ScanEngineUpdates.
7. Open Exchange Management Shell and run:
Start-EngineUpdate
If you have any trouble running Start-EngineUpdate, execute this first: Add-PSSnapin -Name Microsoft.Forefront.Filtering.Management.PowerShell
8. If you updated the PrimaryUpdatePath, you should see an application event log entry for Event ID 6024 showing the path being checked. Shortly thereafter, you will see an Event ID 6031 Stating the update was successful. If you chose to update the SecondaryUpdatePath, wait for the primary to fail as indicated by an Event ID: 6027 and the secondary will be checked as indicated by a Event ID: 6030 which should show your shared resource as the path being checked. This should be followed by an Event ID: 6031 stating the engine update process has successfully downloaded updates for Microsoft. Another indicator you were successful, would be to execute in the Exchange Management Shell: Get-EngineUpdateInformation . This should display the expected updated version and date updated information.
By the way, welcome to my blog post number 1, I will post more of these soon as I already have post # 2 almost ready to go. Comments are always welcome.